Getting Amazon SNS Notifications When a Command Changes Status

To attach the iam:PassRole policy to your user account

1. Open the Identity and Access Management (IAM) console at https://console.aws.amazon.com/iam/.

2. In the navigation pane, choose Users and select the user (under User name).

3. At the top of the page, copy your User ARN to the clipboard.

4. Under Permissions, verify that either the AmazonSSMFullAccess policy is listed or there is a comparable policy that gives you permission to the SSM API.

5. Choose Add inline policy.

6. On the Set Permissions page, choose Policy Generator, and then choose Select.

7. Verify that Effect is set to Allow.

8. From AWS Services choose AWS Identity and Access Management.

9. From Actions choose PassRole.

10. In the Amazon Resource Name (ARN) field, paste your ARN.

11. Choose Add Statement, and then choose Next.

12. On the Review Policy page, choose Apply Policy.

1. Open the Identity and Access Management (IAM) console at https://console.aws.amazon.com/iam/.

2. In the navigation pane, choose Roles, and then choose Create New Role.

3. In Step 1: Set Role Name enter a name that identifies this role as a Run Command role for notifications.

4. In Step 2: Select Role Type choose Amazon EC2. The system skips Step 3: Establish Trust because this is a managed policy.

5. In Step 4: Attach Policy choose AmazonSNSFullAccess.

6. Choose Next Step and then choose Create Role. The system returns you to the Roles page.

7. Locate the role you just created and double-click it.

8. Choose the Trust Relationships tab, and then choose Edit Trust Relationship.

9. Add "ssm.amazonaws.com" to the existing policy as the following code snippet illustrates:

   {
     "Version": "2012-10-17",
     "Statement": [
       {
         "Sid": "",
         "Effect": "Allow",
         "Principal": {
           "Service": "ec2.amazonaws.com",
           "Service": "ssm.amazonaws.com"
         },
         "Action": "sts:AssumeRole"
       }
     ]
   }

   Note

   You must add a comma after the existing entry. "Service": "sns.amazonaws.com", or the JSON will not validate.

10. Choose Update Trust Policy.

11. Copy or make a note of the Role ARN. You will specify this ARN when you send a command that is configured to return notifications.

To send a command from the Amazon EC2 console that returns notifications

1. Open the Amazon EC2 console and choose Command History in the navigation pane.

2. Choose Run a Command.

3. In the Command document list, choose an SSM document.

4. Choose Select target instances to select the instances where you want the command to run. If you do not see a complete list of instances, the missing instances might not be configured properly for Run Command. For more information, see Amazon EC2 Run Command Prerequisites.

5. Enter information in the fields required by the SSM document. In the SNS Notifications section, choose Enable SNS notifications.

6. In the Role field, type or paste the IAM role ARN you created earlier.

7. In the SNS Topic field, type or paste the Amazon SNS ARN you created earlier.

8. In the Notify me on field, choose the events for which you want to receive notifications.

9. In the Notify me for field, choose to receive notifications for each copy of a command sent to multiple instances (invocations) or the command summary.

10. Choose Run.

11. Check your email for a message from Amazon SNS and open the email. Amazon SNS can take a few minutes to send the mail.

To send a command that is configured for notifications from the AWS CLI

1. Open the AWS CLI.

2. Specify parameters in the following command.

   aws ssm send-command --instance-ids "ID-1, ID-2" --document-name "name" --parameters commands=date --service-role ServiceRole ARN --notification-config NotificationArn=SNS ARN

   For example

   aws ssm send-command --instance-ids "i-12345678, i-34567890" --document-name "AWS-RunPowerShellScript" --parameters commands=date --service-role arn:aws-cn:iam:: 123456789012:myrole --notification-config NotificationArn=arn:aws-cn:sns:cn-north-1:123456789012:test

3. Press Enter.

4. Check your email for a message from Amazon SNS and open the email. Amazon SNS can take a few minutes to send the mail.